HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

MTG USA, Inc.

bd_126102988a477557 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 8, 2021

To disclose

—

Affected

3state residents only

Linked

6 filings

Confidence

66%

Full breach record for MTG USA, Inc. →

MTG USA, Inc. notified the New Hampshire Attorney General of a data breach affecting 3 state residents. Malicious code on the company website captured payment card information between June 25, 2020, and June 15, 2021. The company engaged a PCI Forensic Investigator, shut down the site, and migrated to Shopify. Affected individuals received 24 months of identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 25, 2020

Begins

Oct 8, 2021

Filed

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_715d022fb0c6b74c2021-10-05 · +3dVerified
California State AGbd_0018a6255b8b67f82021-09-26 · +12dVerified
Maine State AGbd_3a8167a3ce491ba02021-09-22 · +16dVerified
Montana State AGbd_323a0014aad80b9c2021-09-21 · +17dCandidate

Show 1 more filing ↓up to 28d gap

Indiana State AGbd_936c4266b33dd3c72021-09-10 · +28dVerified

Name: MTG USA, Inc.
norm: mtg usa
Domain: mtg-usa.com

Name: MTG USA, Inc.
norm: mtg usa
Domain: mtg-usa.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jun 25, 2020 – Jun 15, 2021
Materiality determined: —
Notification sent: Sep 16, 2021
Affected individuals: 3state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General John M. Formella
Initial access: exploit_public_facing

During the incident: Engaged a PCI Forensic Investigator (PFI) to investigate and to discover and determine the scope of the breach
Suspended credit card transactions from its ecommerce site
Unilaterally shut down the site and prevented any credit card transactions pending the PFI investigation
Moved the server offline
Reported this security incident to law enforcement
Changes made: Selected a new payment gateway, Shopify
Will not collect, use, store, or transmit card holder data from its site
Elected security controls on the Shopify platform which exceed the minimum required settings, including requiring multi-factor authentication for all administrative users
Enforcing longer password requirements than Shopify standards
Enforcing strict least-privilege rights for MTG USA Shopify user accounts
Enabling address-matching fraud detection features available in the Shopify platform
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGSep 10 · first

Montana State AG+11d

Maine State AG+12d

California State AG+16d

Massachusetts State AG+25d

New Hampshire State AG+28d · this page

Pattern: first filing Sep 10 (IN), last Oct 8 (NH) — a 28-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mtg-usa-20211008.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 8, 2021
Raw hash: 3aebbff3aeb4fe2b00d74198cb926b9a06bb45741c055a50f0eff5b16f829ebf

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMTG USA, Inc.

Victim entityMTG USA, Inc.

IncidentUnauthorized Access

Stated responseEngaged a PCI Forensic Investigator (PFI) to investigate and to discover and determine the scope of the breach

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov